CVE-2026-69212: Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect changes authority, but authority comparison excludes the URI scheme. A same-authority redirect from HTTPS to HTTP therefore preserves credentials and transmits them over a plaintext connection. An attacker who can induce the downgrade and observe the network can capture those sensitive headers from applications using FollowRedirect. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Http4s (FollowRedirect middleware)to a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
Http4s (FollowRedirect middleware)to a version that resolves this vulnerability.Fixed in 1.0.0-M47
Event History
Frequently Asked Questions
Which applications are exposed to credential disclosure?
Applications using Http4s FollowRedirect middleware before version 0.23.35 or 1.0.0-M47 are exposed when they follow a redirect from HTTPS to HTTP on the same authority and send Authorization or Cookie headers.
What does an attacker need to exploit this issue?
An attacker must be able to induce the HTTPS-to-HTTP downgrade redirect and observe the plaintext network connection. No authentication or user interaction is required.
Does the redirect need to point to a different host?
No. The issue specifically affects redirects that retain the same authority because the vulnerable comparison does not account for the URI scheme change.
What should be done if an immediate upgrade is not possible?
Avoid following HTTPS-to-HTTP redirects when requests may include Authorization or Cookie headers, since those headers can be transmitted over plaintext. Upgrade to Http4s 0.23.35 or 1.0.0-M47 when possible.